{"meta":{"title":"KEV entries: Red Hat","description":"All KEV entries for vendor Red Hat.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":9,"vendor":"Red Hat","entries":9,"shareOfCatalogPercent":0.5,"ransomwareKnown":4,"firstDateAdded":"2021-12-10","latestDateAdded":"2026-08-26","rank":30},"data":[{"cveID":"CVE-2015-5287","vendorProject":"Red Hat","product":"Automatic Bug Reporting Tool","vulnerabilityName":"Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability","dateAdded":"2026-08-26","dueDate":"2026-09-09","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-5287","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2015-5287/"},{"cveID":"CVE-2015-3246","vendorProject":"Red Hat","product":"Libuser","vulnerabilityName":"Red Hat Libuser Race Condition Vulnerability","dateAdded":"2026-08-26","dueDate":"2026-09-09","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. ","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://access.redhat.com/articles/1537873 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3246","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2015-3246/"},{"cveID":"CVE-2018-14667","vendorProject":"Red Hat","product":"JBoss RichFaces Framework","vulnerabilityName":"Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability","dateAdded":"2023-09-28","dueDate":"2023-10-19","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667; https://nvd.nist.gov/vuln/detail/CVE-2018-14667","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2018-14667"},{"cveID":"CVE-2021-3560","vendorProject":"Red Hat","product":"Polkit","vulnerabilityName":"Red Hat Polkit Incorrect Authorization Vulnerability","dateAdded":"2023-05-12","dueDate":"2023-06-02","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-863"],"shortDescription":"Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://bugzilla.redhat.com/show_bug.cgi?id=1961710; https://nvd.nist.gov/vuln/detail/CVE-2021-3560","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2021-3560"},{"cveID":"CVE-2021-4034","vendorProject":"Red Hat","product":"Polkit","vulnerabilityName":"Red Hat Polkit Out-of-Bounds Read and Write Vulnerability","dateAdded":"2022-06-27","dueDate":"2022-07-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-4034","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-4034"},{"cveID":"CVE-2010-1428","vendorProject":"Red Hat","product":"JBoss","vulnerabilityName":"Red Hat JBoss Information Disclosure Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-1428","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-1428"},{"cveID":"CVE-2010-0738","vendorProject":"Red Hat","product":"JBoss","vulnerabilityName":"Red Hat JBoss Authentication Bypass Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-0738","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-0738"},{"cveID":"CVE-2017-12149","vendorProject":"Red Hat","product":"JBoss Application Server","vulnerabilityName":"Red Hat JBoss Application Server Remote Code Execution Vulnerability","dateAdded":"2021-12-10","dueDate":"2022-06-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-12149","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-12149"},{"cveID":"CVE-2010-1871","vendorProject":"Red Hat","product":"JBoss Seam 2","vulnerabilityName":"Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability","dateAdded":"2021-12-10","dueDate":"2022-06-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-1871","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2010-1871"}]}